Alpha Team Research: Deep Dive into Cerberus Banking Malware

A new banking trojan Cerberus is in the wild and available in a primarily Russian cybercrime forum. The trojan has the ability to determine the top level window and if the application is a banking app, the trojan has the ability to overlay a fake screen on top of the bank’s dialog in order to collect personal information, such as: username, last name, first name, password, date of birth, and social security number. There is no exploit vector in the wild and the trojan must be installed through social engineering or phishing.

Recommendations

If you are a financial customer, we recommend turning on app store impersonation coverage to find potentially malicious apps
Consider enabling Cyber Attack Chatter in the platform to monitor chatter related to this malware
Enable 2-factor authentication to help prevent phishing attacks

Details

Cerberus, a new banking trojan, is making waves in the malware-for-rent business. Popular banking trojans, such as Anubis, Red Alert 2.0 and GM Bot had previously cornered the market, but as these trojans and associated botnets have gone offline, Cerberus has taken their place.

Cerberus is a trojan for Android that, once installed, allows the attacker to take complete control of the system. Like most trojans, once activated, it hides itself from installed application. Then, the trojan masquerades as a Flash Player Service and requests permission to use the Accessibility Services. If this is granted, the trojan registers itself with its command and control server and allows a remote attacker to perform a variety of functions. Cerberus does not exploit a vulnerability to end up on a user’s Android device. Instead, it relies on social engineering to get the application installed on the end user’s phone.

Some of the capabilities of the trojan include: taking screenshots, recording audio, recording keylogs, sending, receiving, and deleting SMSes, stealing contact lists, forwarding calls, collecting device information, tracking device location, stealing account credentials, disabling Play Protect, downloading additional apps and payloads, removing apps from the infected device, pushing notifications, and locking the device's screen.

One of the main features of the trojan is the ability to overlay dialogs on top of legitimate banking applications. As mentioned before, access to the Accessibility Services permission allows the trojan to obtain the package name of the top level window which it uses to determine if a banking app is currently displayed. Cerberus has overlays for: 7 U.S. banking apps, 7 French banking apps, 1 Japanese banking app and 15 non-banking apps. Typically, the username, last name, first name, password, date of birth, and social security number are the types of data that the trojan collects.

The authors also use some tricks to make it harder to execute the trojan within a virtualized environment. Specifically, they detect if there is motion while using the device by measuring the output of the accelerometer. The logic behind this is that a virtualized environment would not produce the same accelerometer readings as a real phone, so the attacker would know not to execute the trojan with full capabilities. These tactics make reverse engineering the trojan more difficult.

Even for interested parties with cash in hand, obtaining the malware is neither cheap nor easy. The authors advertise renting the malware for various chunks of time: $2000 for 1 month usage, $7000 for 6 months and up to $12,000 for 12 months. However, not everyone is granted access to the bot. Below is a post made regarding the availability of the trojan to potential buyers posted by the authors on Aug 08, 2019:

Дорогие друзья, прошу не обижаться тем, кому мы отказали даже в тесте. Мы выбираем партнёров, у которых взникнет минимум проблем, и выноса мозга, тех кто знаком более менее со сферой, или готов в ней разбираться. Увы, с абы кем мы работать не будем.

Так же в команду (для сотрудничества) требуются следующие люди:
- кто сможет делать точечную работу по US, UK, CA, AT, AU и JP(Япония в приоритете) банкам;
- Имеют лоадеры в Google Play которые имеют более 100к установок.
- Знакомы с веб дизайном, css, js (без jquery) для написания инжектов.

Dear friends, I ask you not to be offended if we refused you a test and a bot. By special criteria, we choose people who can work with the bot and get profit from it.

The following people are also required in the team:
- To work on banks of the following countries: US, UK, CA, AT, AU and JP (Japan is a priority);
- They have loaders on Google Play that have more than 100k installations.
- Familiar with web design, css, js (without jquery) for writing injections.

Some key takeaways from this message are that the banks they target are within a tight ecosystem. They are targetting wealthy countries specifically and omit all Commonwealth of Independent States (CIS), most notably. Additionally, the user must have an application that has the capability to load external software and that the software must be installed at least 100,000 times. As stated previously, there is no exploit vector to get Cerberus on an end user’s phone. Instead, social engineering and phishing attacks would be used to convince the user to download Cerberus which is precisely why they require web development experience. The no jQuery requirement is likely to avoid common, fingerprintable Javascript patterns which would lower the efficacy of the phishing pages used to install Cerberus.

These requirements allow the users of Cerberus to form a unique community. Meaning, all partners have the ability to contribute to the ecosystem and no one can just use the app individually without contributing at least 100,000 installs of their own applications. And take note, the installs must be on the Google Play marketplace, and not a secondary market, which makes obtaining the requisite number of installs even harder.

Additionally, ensuring that the trojan operates in specific markets, they can guarantee a density of available botsover a lucrative attack surface. This seems to be a reason they target the countries that they do, in addition to the perceived wealth of the nations mentioned.

Breaking News: 2019-08-13

HVACking: Remotely Exploiting Bugs in Building Control Systems - BleepingComputer

A well-known and well-mitigated vulnerability, buffer overflow, was found in a popular controller for managing critical systems by McAfee Threat Research. This research shows how hard it is for critical infrastructure vendors to find and patch vulnerabilities before they are shipped, but also that the industry lacks information security professionals and research to help secure systems tied to physical control systems.

See the full report here: https://www.bleepingcomputer.com/news/security/hvacking-remotely-exploiting-bugs-in-building-control-systems/

4 Dating Apps Pinpoint Users Precise Locations and Leak the Data

Researchers at Pen Test Partners found that they could determine the exact location of users of Grindr, Romeo, Recon and 3fun just by knowing the username of the targeted user. The researchers used spoofed location data to obtain distances to a given user from multiple points which allowed them to triangulate the user with precision. Additionally, Grindr includes altitude data which can be further used to determine elevation along with precise latitude and longitude.

See the full report here: https://threatpost.com/4-dating-apps-pinpoint-precise-locations/147247/

Curious Orca BEC Scammers Use Email Probes to Validate Targets - BleepingComputer

Business Email Compromise fraudsters are getting more advanced - this group known as "Curious Orca" uses a series of validation steps to qualify their "lead" lists. This is eerily similar to how sales teams build lead lists, and it also goes to show that the cybercrime community has a vibrant economy when it comes to how you can help their mission.

See the full report here: https://www.bleepingcomputer.com/news/security/curious-orca-bec-scammers-use-email-probes-to-validate-targets/

Header aches in Firefox, Tor, Brave and Chrome as HTTP opens new security holes

Alt-Svc is a relatively new header in the world of web. First created in 2016, the header is primarily used to redirect clients to other services, in order to help with load balancing or directing traffic to a closer server. The research for this header shows that browsers have implemented the header in an insecure manner, where a malicious server can issue Alt-Svc to a Firefox or Tor client to port scan a machine that the victim has access to, leading to privacy concerns.

See the full report here: https://www.theregister.co.uk/2019/08/13/header_banged_for_bafflingly_bad_behavior/